Customer database not registered with the CNIL: sale null and void

By a new decision on the 25th of June 2013, the French Supreme Court ("Cour de Cassation") concluded that the sale of a client database was null and void on account of having an unlawful object, as it had not been registered with the French Data Protection Authority ("CNIL").

In this instance, an action was brought against the Bout-Chard company to nullify the sale of a client database, for the reason that the database had not been registered with the CNIL. Indeed, in accordance with the provisions of the French Data Protection Act relating to the processing of personal data - here data concerning the customers – the automatic processing is subject to a notification to the CNIL.

The Court of Appeal in Rennes rejected the claim for the sale to be nullified. They found that Bout-Chard's customer database ought to have been registered with the CNIL, and that it was not, but considered that French law did not intend that the absence of such a notification should be sanctioned by nullification.

However, the French Supreme Court has overruled this approach, considering that only things which may be the subject matter of legal transactions between parties may be the object of agreements (Article 1128 of the French Civil Code). Therefore, as the client database was not registered with the CNIL, its sale by Bout-Chard had an unlawful object.

This new decision thus extends, for commercial matters, the jurisprudence already generated for many years by the French Supreme Court for employment matters, according to which automated processing of personal data concerning employees is not enforceable against those employees, and can therefore not be used against them without it first being registered with the CNIL.

This is an important decision for companies wishing to sell or rent their files for marketing uses. Also, for companies in liquidation, their administrators, and/or the eventual buyers of their assets, this position reaffirms the importance of verifying that the formalities required by the CNIL were correctly fulfilled. In fact, customer databases often make up an element of the assets which it is tempting to sell off, under the condition that they are legally constituted.